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DETAILED ACTION 

1. This office action is in response to the amendment filed 03/21/05. 

2. Claims 1 , 4, 20, 23, 24 and 25 were amended. 

3. Claim 22 is canceled. 

4. Claims 1-21 and 23-26 are pending in this office action. 

Response to Arguments 

5. Applicant's arguments filed 04/21/05, with respect to the rejection(s) of 
claim(s) 1-21 and 23-26 under 35 U.S.C. §1 02(e) as being anticipated by U.S. 
Patent 6,359,976 by Kalyanpur et al. have been fully considered and are 
persuasive. Particularly, the examiner agrees that Kalyanpur does not disclose 
"each remote network location stores a local table containing event data 
generated at the remote location and one or more replica tables containing event 
data generated at other remote locations" and a "union of the local and replica 
tables is generated to form a combined event database at the remote location" 
(as from claim 1). Therefore, the rejection has been withdrawn. However, upon 
further consideration, a new ground(s) of rejection is made based on U.S. Patent 
6,185,613 by Lawson et al. in view of U.S. Patent 5,903,893 by Kleewein et al. 

Information Disclosure Statement 

6. The information disclosure statements (IDS) submitted on 12/07/04 and 
02/22/05 have been considered by the examiner. 
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Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 1 02 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

8. Claims 1-21 and 23, 25 and 26 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over U.S. Patent 6,185,613 by Lawson et al. (Lawson) in 
view of U.S. Patent 5,903,893 by Kleewein et al. (Kleewein). 

9. With respect to Claim 1 , Lawson teaches a method for providing an 
improved network monitoring system, the network monitoring system comprising 
an event database for storing event data representing events occurring on the 
network, the event data being gathered by a plurality of monitoring devices 
located at a plurality of different, remote locations on the network, the method 
comprising: allowing users to insert one or more triggers into the event database 
(Col. 19 line 53 - Col. 20 line 2 and Col. 20 line 36 - Col. 19), the triggers 
automatically initiating a programmed response at the detection of a condition 
including gathered event data prior to insertion of the gathered event data into 
the event database (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 29); 
distributing the event database to a plurality of remote network locations (Col. 8 
lines 14-58 and Col. 10 lines 7-23), wherein each remote network location stores 
a local table containing event data generated at the remote location (Col. 8 lines 
36-58) and one or more replica tables containing event data generated at other 
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remote locations (Col. 10 lines 7-23 and Col. 15 lines 14-32), and using triggers 
and local and replica tables during delivery of event data to users of the network 
monitoring system (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 29). 
Lawson further suggests that global information and local information could be 
stored in a common file or in some other format that achieves the essential 
functionality of the invention (Col. 8 lines 59-67), 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
to form a combined event database at the remote location. Kleewein teaches the 
union of a local and remote table to form a combined database (Col. 3 lines 7-23 
and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson and modify it as 
indicated by Kleewein such that the method further comprises wherein a union of 
the local and replica tables is generated to form a combined event database at 
the remote location and using triggers and local and replica table unions during 
delivery of event data to users of the network monitoring system. One would be 
motivated to have this, as there is desire for enabling transparent access to data 
stored in multiple databases (In Kleewein: Col. 1 lines 45-56). 
1 0. With respect to Claim 2, Lawson in view of Kleewein teaches all the 
limitations of Claim 1 and further teaches providing a notification component for 
registering similar client requests for event data and substantially 
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contemporaneously delivering requested event data to all clients having similar 
registered requests (In Lawson: Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 
line 29). 

1 1 . With respect to Claim 3, Lawson teaches an event database for use in a 
network monitoring system, the event database storing event data representing 
events occurring on the network, the event data being gathered by a plurality of 
monitor devices located at a plurality of different, remote locations on the 
network, the event database comprising: an automation engine for processing 
one or more triggers contained in the event database (Col. 19 line 53 - Col. 20 
line 2 and Col. 20 line 36 - Col. 19), the triggers automatically initiating a 
programmed response at the detection of a condition including on gathered event 
data prior to insertion of the gathered event data into the event database (Col. 6 
lines 7-23 and Col. 28 line 40 - Col. 29 line 29); a local table stored at each 
remote network location containing event data generated at the remote location 
(Col. 8 lines 36-58); and one or more replica tables stored at each remote 
network location containing event data generated at other remote locations (Col. 
10 lines 7-23 and Col. 15 lines 14-32). Lawson further suggests that global 
information and local information could be stored in a common file or in some 
other format that achieves the essential functionality of the invention (Col. 8 lines 
59-67). 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
to form a combined event database at the remote location. Kleewein teaches the 
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union of a local and remote table to form a combined database (Col. 3 lines 7-23 
and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the event database disclosed by Lawson and modify 
it as indicated by Kleewein such that the event database further comprises 
wherein a union of the local and replica tables is generated to form a combined 
event database at the remote location. One would be motivated to have this, as 
there is desire for enabling transparent access to data stored in multiple 
databases (In Kleewein: Col. 1 lines 45-56). 

12. With respect to Claim 4, Lawson teaches a method for handling event 
data from monitored sites in a computer network, comprising: receiving event 
data from the sites at a monitoring location (Col. 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29); when received at the monitoring location, pre-processing the 
event data before the event data is inserted into an event database to determine 
if a condition is met as set forth in a trigger (Col. 6 lines 7-23 and Col. 28 line 40 - 
Col. 29 line 29); and if the trigger condition is met, initiating an action relating to 
the event data, the action being defined in the trigger (Col. 6 lines 7-23 and Col. 
28 line 40 - Col. 29 line 29); inserting the event data into the event database 
thereby producing central data (Col. 8 lines 14-35 and Col. 28 line 40 - Col. 29 
line 29); and transmitting the central data to each of the monitored sites (Col. 10 
lines 7-23 and Col. 15 lines 14-32): wherein each of the monitored sites includes 
locally-generated event data (Col. 8 lines 36-58) and a replica of the central data 
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(Col. 10 lines 7-23 and Col. 15 lines 14-32).Lawson further suggests that global 
information and local information could be stored in a common file or in some 
other format that achieves the essential functionality of the invention (Col. 8 lines 
59-67). 

However, Lawson does not explicitly disclose a union of the locally- 
generated event data and the central data is formed at each of the monitored 
sites. Kleewein teaches the union of a local and remote table to form a 
combined database (Col, 3 lines 7-23 and Col. 1 line 45 - Col. 2 line 23). The 
union of databases provides for transparent access to the data stored in both 
tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson and modify it as 
indicated by Kleewein such that the method further comprises wherein a union of 
the locally-generated event data and the central data is formed at each of the 
monitored sites. One would be motivated to have this, as there is desire for 
enabling transparent access to data stored in multiple databases (In Kleewein: 
Col. 1 lines 45-56). 

1 3. With respect to Claim 5, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein pre-processing the event data 
comprises determining whether the event data comprises a duplication of other 
event data in the event database or received at the monitoring location (In 
Lawson: Col. 17 lines 6-21). 
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14. With respect to Claim 6, Lawson in view of Kleewein teaches all the 
limitations of Claim 5 and further teaches initiating the action comprises denying 
storage of the event data in the event database if it comprises a duplication of 
other event data (In Lawson: Col. 19 lines 22-42). 

15. With respect to Claim 7, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein if the event data does not meet 
the condition, it is temporarily stored outside the data source (In Lawson: Col. 21 
lines 8-18, Col. 23 line 60 - Col. 24 line 6 and Col. 26 lines 25-35). 

16. With respect to Claim 8, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein for even data received at the 
monitoring location, a query is executed, and a condition is evaluated, which, if 
true, causes the execution of the action (In Lawson: Col. 23 line 60 - Col. 24 line 
6 and Col. 24 lines 20-41). 

17. With respect to Claim 9, Lawson in view of Kleewein teaches all the 
limitations of Claim 8 and further teaches wherein the action comprises at least 
one of a sequence of Structured Query Lanaguage (SQL) statements and an 
external script (In Lawson: Col. 6 lines 7-23 and CoL 28 line 40 - Col. 29 line 29) 

18. With respect to Claim 10, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the trigger has a coupling 
mode that indicates when the action should be executed (In Lawson: Col. 24 
lines 20-41 and Col. 26 lines 17-24). 

1 9. With respect to Claim 1 1 , Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the trigger allows an 
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administrator of the network to connect events, conditions and actions (In 
Lawson: Col. 10 lines 24-56). 

20. With respect to Claim 12, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the event data comprises a 
primitive event (In Lawson: Col. 11 lines 9-26). 

21 . With respect to Claim 1 3, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the event data comprises a 
database event (In Lawson: Col. 11 lines 9-26). 

22. With respect to Claim 14, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the event data comprises a 
temporal event (In Lawson: Col. 1 1 lines 9-26). 

23. With respect to Claim 15, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the trigger comprises a 
database trigger (In Lawson: Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 
29), 

24. With respect to Claim 16, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the trigger comprises a 
temporal trigger (In Lawson: Col. 6 lines 7-23 and Col. 28 line 40 - Col, 29 line 
29). 

25. With respect to Claim 17, Lawson in view of Kleewein teaches all the 
limitations of Claim 16 and further teaches wherein the temporal trigger signals 
an event at a determined frequency from a specified start time until a specified 
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end time (In Lawson: Col. 6 lines 7-23, Col. 24 lines 20-41 and Col. 26 lines 17- 
24, also see claim 8 ). 

26. With respect to Claim 1 8, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein initiating an action comprises 
communicating a message in accordance with the event data to at least one 
customer location that has subscribed to receive the event data, and storing the 
event data in a data store at the monitoring location (In Lawson: Col. 28 line 40 - 
Col. 29 line 29 and Col. 10 lines 7-23). 

27. With respect to Claim 1 9, Lawson in view of Kleewein teaches all the 
limitations of Claim 18 and further teaches wherein the pre-processing occurs, at 
least in part, during a period when the data store is inaccessible (In Lawson: Col, 
10 lines 57-67). 

28. With respect to Claim 20, Lawson in view of Kleewein teaches all the 
limitations of Claim 18 and further teaches wherein the message communicated 
in accordance with the event data is included in the union of at least event data 
of a local network and event data of a remote network (In Lawson: Col. 8 lines 
14-58 and Col. 10 lines 7-23) 

29. With respect to Claim 21 , Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the union comprises a union of 
event data tables (In Lawson: Col. 8 lines 14-58 and Col. 10 lines 7-23) 

30. With respect to Claim 23, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 and further teaches wherein the monitoring locations 
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update one another with their event data (In Lawson: Col. 10 line 7-23 and Col. 
28 line 40 - Col. 29 line 29). 

31 . With respect to Claim 25, Lawson teaches a system for handling event 
data from monitoring sites in a computer network, comprising: means for 
receiving event data from the sites at a monitoring location (Col. 6 lines 7-23 and 
Col. 28 line 40 - Col. 29 line 29); means for pre-processing the event data, when 
received at the monitoring location, to determine if a condition is met for setting a 
trigger (Col. 6 lines 7-23 and Col. 28 line 40 - Col. 29 line 29); means for 
communicating a message, if the trigger is set, in accordance with the event data 
to at least one customer location that has subscribed to receive the event data 
and storing the event data in a data store at the monitoring location(Col. 6 lines 
7-23 and Col. 28 line 40 - Col. 29 line 29); means for inserting the event data into 
the event database thereby producing central data (Col. 8 lines 14-35 and Col. 
28 line 40 - Col. 29 line 29); and means for transmitting the central data to each 
of the monitored sites (Col. 10 lines 7-23 and Col. 15 lines 14-32): wherein each 
of the monitored sites includes locally-generated event data (Col. 8 lines 36-58) 
and a replica of the central data (Col. 10 lines 7-23 and Col. 15 lines 14- 
32). Lawson further suggests that global information and local information could 
be stored in a common file or in some other format that achieves the essential 
functionality of the invention (Col. 8 lines 59-67), 

However, Lawson does not explicitly disclose a union of the locally- 
generated event data and the central data is formed at each of the monitored 
sites. Kleewein teaches the union of a local and remote table to form a 
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combined database (Col. 3 lines 7-23 and Col. 1 line 45 - Col. 2 line 23). The 
union of databases provides for transparent access to the data stored in both 
tables (Col. 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the system disclosed by Lawson and modify it as 
indicated by Kleewein such that the system further comprises wherein a union of 
the locally-generated event data and the central data is formed at each of the 
monitored sites. One would be motivated to have this, as there is desire for 
enabling transparent access to data stored in multiple databases (In Kleewein: 
Col. 1 lines 45-56). 

32. With respect to Claim 26, Lawson teaches an event database for use in a 
network monitoring system, the event database storing event data representing 
events occurring on the network, the event data being gathered by a plurality of 
monitor devices located at a plurality of different, remote locations on the 
network, the event database comprising: a local table stored at each remote 
network location containing event data generated at the remote location (Col. 8 
lines 36-58); one or more replica tables stored at each remote network location 
containing event data generated at other remote locations (Col. 10 lines 7-23 and 
Col. 15 lines 14-32). Lawson further suggests that global information and local 
information could be stored in a common file or in some other format that 
achieves the essential functionality of the invention (Col. 8 lines 59-67). 

However, Lawson does not explicitly disclose a union of the local and 
replica tables (cache of the global registry at each remote location) is generated 
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to form a combined event database at the remote location. Kleewein teaches the 
union of a local and remote table to form a combined database (Col. 3 lines 7-23 
and Col. 1 line 45 - Col. 2 line 23). The union of databases provides for 
transparent access to the data stored in both tables (CoL 1 lines 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the event database disclosed by Lawson and modify 
it as indicated by Kleewein such that the event database further comprises 
means for generating a union of the local and replica tables to form a combined 
event database at the remote location. One would be motivated to have this, as 
there is desire for enabling transparent access to data stored in multiple 
databases (In Kleewein: Col. 1 lines 45-56). 

33. Claim 24 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Lawson in view of Kleewein as applied to claim 4 above, and further in view of 
U.S. Patent 6,341,340 by Tsukerman et al. (Tsukerman). 

34. With respect to Claim 24, Lawson in view of Kleewein teaches all the 
limitations of Claim 4 but does not explicitly disclose at least one monitoring 
location is enabled to take ownership of a replica of remotely-generated event 
data to make modification thereto without instructions from the remote monitoring 
location associated therewith. 

Tsukerman teaches the use of ownership in the case where a database 
may be shared between multiple locations (Col. 6 lines 13-33 and Col. 7 line 37 - 
Col. 8 line 22). When a location is given ownership of a database (Col. 7 lines 
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15-28 and Col. 8 lines 50-62), the location can make modifications to the 
database without instructions from any other associated location (Col. 8 lines 4- 
22). This allows for better performance in database operations (Col. 2 lines 6-14 
and 45-56). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Lawson in view of 
Kleeweing and modify it as indicated by Tsukerman such that the method further 
comprises wherein at least one monitoring location is enabled to take ownership 
of a replica of remotely-generated event data to make modification thereto 
without instructions from the remote monitoring location associated therewith. 
On would be motivated to have this, as it is desirable to have performance 
advantages (In Tsukerman: Col. 2 lines 6-14 and 45-56). 

Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to David Lazaro whose telephone number is 
571-272-3986. The examiner can normally be reached on 8:30-5:00 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Saleh Najjar can be reached on 571-272-4006. The fax 
phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from 
tine Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 




David Lazaro 
July 19, 2005 




